Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3WorkshopDLv2.0.0.7z
windows11-21h2-x64
7Modules/AdvTray.dll
windows11-21h2-x64
3Modules/Archive.dll
windows11-21h2-x64
3Modules/Download.dll
windows11-21h2-x64
3Modules/Get.dll
windows11-21h2-x64
3Modules/KcBoxA.dll
windows11-21h2-x64
3Modules/KcBoxB.dll
windows11-21h2-x64
3Modules/KcButton.dll
windows11-21h2-x64
3Modules/PopupMenu.dll
windows11-21h2-x64
3Modules/Pr...ar.dll
windows11-21h2-x64
3Modules/Tr...ol.dll
windows11-21h2-x64
3Modules/appids.txt
windows11-21h2-x64
3Modules/fcFolder.dll
windows11-21h2-x64
3Modules/games.txt
windows11-21h2-x64
3Modules/kccombo.dll
windows11-21h2-x64
3Modules/kcedit.dll
windows11-21h2-x64
3Modules/kcfile.dll
windows11-21h2-x64
3Modules/kcini.dll
windows11-21h2-x64
3Modules/kcinput.dll
windows11-21h2-x64
3Modules/kclist.dll
windows11-21h2-x64
3Modules/kcpop.dll
windows11-21h2-x64
3Modules/kcriched.dll
windows11-21h2-x64
3Modules/kcwctrl.dll
windows11-21h2-x64
3Modules/mmfs2.dll
windows11-21h2-x64
3WorkshopDL.dat
windows11-21h2-x64
3WorkshopDL.exe
windows11-21h2-x64
6WorkshopDL.ini
windows11-21h2-x64
3Analysis
-
max time kernel
93s -
max time network
101s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/08/2024, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
WorkshopDLv2.0.0.7z
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Modules/AdvTray.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Modules/Archive.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Modules/Download.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Modules/Get.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Modules/KcBoxA.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Modules/KcBoxB.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
Modules/KcButton.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
Modules/PopupMenu.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
Modules/ProgressBar.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
Modules/TreeControl.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Modules/appids.txt
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
Modules/fcFolder.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
Modules/games.txt
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
Modules/kccombo.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
Modules/kcedit.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
Modules/kcfile.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
Modules/kcini.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
Modules/kcinput.dll
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
Modules/kclist.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
Modules/kcpop.dll
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
Modules/kcriched.dll
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
Modules/kcwctrl.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
Modules/mmfs2.dll
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
WorkshopDL.dat
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
WorkshopDL.exe
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
WorkshopDL.ini
Resource
win11-20240802-en
General
-
Target
Modules/Archive.dll
-
Size
97KB
-
MD5
0d1416e079cc907971a7eebe49189eb1
-
SHA1
4e0ccfc37e738df826b526f3e7016b2c45e415cf
-
SHA256
c75918d99dd8983fff3dc51ea3f28ad7a9da8c84f273e5a20736f227626fb50b
-
SHA512
7f7cc470a74a5063f3a922d182a0e394016ac7ad97daca766ab38c63d837534df46cc4dffd88b0e5e9106e80db551568ee75dd35bb5fe22581bc2ed41a5f5d0e
-
SSDEEP
3072:OpZ807jkNqfPD/bQTiZoPK1Nkcm3udzss6qnMny7vOyefz+:OppjkNq/e3ctf6qnMnyDOyeL+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 224 wrote to memory of 1480 224 rundll32.exe 81 PID 224 wrote to memory of 1480 224 rundll32.exe 81 PID 224 wrote to memory of 1480 224 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\Archive.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\Archive.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1480
-